ci(publish): pin Doenet site DoenetML version on publish

[dqnykamp]

Context

When we publish a new DoenetML version, the Doenet site loads @doenet/standalone from jsDelivr keyed by the version string stored in its doenetmlVersions table. That string is currently a moving npm tag (latest/dev), so the CDN URL doesn't change on a new publish and browsers keep serving the cached old bundle until users clear their cache.

The companion site PR (Doenet/DoenetApps#3011) makes the site store a concrete version and adds a POST /api/info/updateTrackedDoenetmlVersion endpoint. This PR calls that endpoint from the publish workflow so the site pins to the exact version we just published — an immutable jsDelivr URL, no browser-cache wait.

Changes

• Expose the published version as a job output (dev-release, production-release).
• Add notify-site-dev / notify-site-prod as separate jobs (needs the corresponding release job). Running them separately means a failure here does not republish to npm — GitHub notifies on the failed job and Re-run failed jobs retries only this step. The site endpoint is idempotent, so retries are safe. Both skip on dry-run.
• Shared .github/scripts/notify-site-version.sh (mirrors the existing purge-jsdelivr.sh convention): posts to doenet.org (required — fails the job loudly) and dev3.doenet.org (best-effort warning, since dev3 auto-scales to zero).

Requirements

• Add repository secret DOENET_VERSION_UPDATE_SECRET (repo-level, like VSCE_PAT, so both the dev and production jobs can read it). Its value must match DOENETML_VERSION_UPDATE_SECRET on the site.
• Merge after the site PR is deployed and the initial versions are pinned.

Verification

• bash -n + full YAML parse (all 5 jobs recognized).
• Script control flow driven locally against the real site endpoint: success pins the row; a down best-effort target → ::warning:: + exit 0; a down required target → ::error:: + exit 1. The version is validated by the site's SemVer check.
• Version scheme independence: the notify jobs send the exact string the publish job produced (via job output), so they work regardless of the dev-version format.

🤖 Generated with Claude Code